{"slug": "your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was", "title": "Your agent's 'secure' network policy was off unless you did four steps — so it was off", "summary": "The enclave project released version 0.8.0, fixing several security and reliability issues in its sandboxed runtime for autonomous LLM agents. The update addresses a network egress policy that was effectively off unless users performed a four-step manual activation, a read-only mount that did not prevent secret reads, and a health check that reported API keys as present even when they were invalid. The release also includes a scanner for an allowlist that had no enforcer, and new tools for measuring token costs.", "body_md": "If you run an autonomous LLM agent in a container, here is a question worth sitting with: **is your\nnetwork egress policy actually enforced, or is it enforced if you performed a setup ritual you did\nonce, months ago, on one machine?**\n\nWe shipped [enclave](https://github.com/wartzar-bee/enclave) 0.8.0 (Apache-2.0, the sandboxed runtime\n\nour own agent fleet runs on) around exactly that failure mode. The short version: **a safety control\nwith a four-step activation cost is, in practice, off** — and \"off unless you opt in\" reads on a\n\nMounting your `secrets/`\n\ndirectory read-only (`:ro`\n\n) feels like scoping. It isn't. `:ro`\n\nstops\n\n*writes*; it does nothing about *reads*. A compromised or prompt-injected agent reads every file it\n\ncan see — so \"scoped credentials\" was only ever true if the **directory** was scoped, not the mount\n\nmode. 0.8.0 makes `SECRETS_DIR`\n\nscope the mount and adds `SECRETS_SCOPE`\n\nso a pod declares what it\n\nactually needs, instead of getting handed the whole vault behind a `:ro`\n\nflag that reads as safe.\n\nSame theme across the release:\n\n`enclave new`\n\n`--unsafe-network`\n\nopts out). It\nwas never \"off by default\" — it was off unless you ran a four-step manual ritual, and that\nactivation cost was the hole. The real network wall is a sidecar owning the agent's netns with a DNS\nproxy + nftables default-deny that command-string tricks (`U=$host; curl $U`\n\n) can't walk around.`web_chat`\n\nrefuses to start on a non-loopback bind with an empty token`0.0.0.0`\n\ninside the container by necessity, so the only thing between a changed bind and an\nunauthenticated control surface into a `PERMISSION=dangerous`\n\nagent was the Docker publish — and\nnothing cross-checked the two.`.publish-audit-allow`\n\nhad shipped with no\nenforcer — grep found exactly one reference to the file: itself. An allowlist for a control that\ndoesn't run reads as a working control, which is worse than none. 0.8.0 ships the scanner, in CI,\nfailing closed if the allow file goes missing.`exists()`\n\n, not `works()`\n\nThe one I like most is smaller. Our image-capability preflight returned `path.exists()`\n\non the API\n\nkey file. So through a whole stretch where a pod's key answered **401 on every call**, the capability\n\nboard cheerfully read `image: ok — key present`\n\n. The false alarm and the false all-clear were equally\n\ninvisible; a resolved blocker stayed quoted as open for days. It now **authenticates** against the\n\nprovider's free key-check endpoint (no generation spend): 200 → works, 401 → present but dead (with\n\nthe refresh instruction), anything else → inconclusive. \"Present\" is not \"works,\" and a probe that\n\ncan't tell *dead* from *down* diagnoses neither.\n\nIf you maintain agent infra, audit your health checks for this class: **every exists() that stands\nin for works() is a green light wired to nothing.**\n\nenclave exists to run autonomous agents *cheaply* — model-tier routing, manager→worker delegation,\n\nand measuring token spend instead of guessing at it. Safety and cost are the same discipline: both die\n\nthe same way, to a default that looks fine on a dashboard and isn't. The same cost discipline ships as\n\ntwo standalone tools you can drop into any project, no runtime required:\n\n`npm i -g @wartzar-bee/tokenscope`\n\n— measures the token cost of prompts, files, and diffs so you see what a change costs Full changelog: [enclave 0.8.0](https://github.com/wartzar-bee/enclave/blob/main/CHANGELOG.md#080--2026-08-22).\n\nIt's a public alpha we run daily against a live fleet — issues and bridges welcome.", "url": "https://wpnews.pro/news/your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was", "canonical_source": "https://dev.to/wartzarbee/your-agents-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was-off-409k", "published_at": "2026-08-26 00:00:06+00:00", "updated_at": "2026-08-26 00:13:40.243802+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-infrastructure", "developer-tools"], "entities": ["enclave", "wartzar-bee", "tokenscope"], "alternates": {"html": "https://wpnews.pro/news/your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was", "markdown": "https://wpnews.pro/news/your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was.md", "text": "https://wpnews.pro/news/your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was.txt", "jsonld": "https://wpnews.pro/news/your-agent-s-secure-network-policy-was-off-unless-you-did-four-steps-so-it-was.jsonld"}}